“Tell me how to make a bomb” Terrorist use of conversational AI: evidence and prospects

In late August, a teenager was arrested in Montreal, Canada. He was suspected of planning a school attack, motivated by an extremist ideology. While details of this case are still concealed, one aspect seemed particularly noteworthy: the teenager “is alleged to have used artificial intelligence in the potential planning of an attack”, according to the police.

Artificial Intelligence (AI) is quickly becoming a key feature in terrorist activities. Since the beginning of 2025, ICCT has identified at least eleven terrorist and extremist plots in Europe and North America, involving the use of generative AI. In this analysis we aim to better describe how AI is already facilitating terrorism, as well as to reflect on how AI’s use by terrorist actors could further develop in the future. To do so, we start by analysing twelve violent plots that were supported by AI chatbots, and we compare our findings with experts’ assessments on the possible malicious use of AI. In doing so, we aim to offer a realistic assessment of possible future developments.

Known risks

The various risks linked to the intersection of AI and terrorism have become a growing focus of research and policy attention. For instance, recent research has shown the wide use of AI tools to generate and disseminate extremism content and propaganda, within jihadi online networks, as well as far-right accelerationist ones. Research has also looked into the use of AI to design weapons – including bioweapons, – or to facilitate the execution of complex and innovative types of attacks, such as cyber-attacks, or attacks through drones or autonomous vehicles. Other research has explored the radicalisation potential of AI chatbots, explaining how the features of these chatbots are designed to reinforce radicalisation processes, rather than reducing them. 

A recent research project from Cambridge University, based on interviews with Boko Haram militants, demonstrated how terrorist groups are already using AI chatbots to improve their operations, for instance by increasing the power of their explosive devices or by perfecting their tactical and technical attack skills. In their own words: “[they] use it a lot”. The same research also shows how jihadi groups are strategically approaching generative AI, by providing training and guidelines to their regional affiliates. Overall, it demonstrates how easily terrorist groups can bypass all guardrails put in place by the chatbots.

This last point has been a topic of research in itself. Experts have tested various AI chatbots with terrorism content, concluding that the majority of them were willing to offer support to extremist actors, even for unequivocally nefarious activities. Tech Against Terrorism similarly tested 27 AI models with terrorism-related prompts, finding that a third of these models provided responses to the request, which were deemed helpful to enhance terrorist activities. Linked to this, research has also shown how terrorist actors are learning and sharing tips on how to “jailbreak” these AI chatbots, in order to obtain what they need.

Finally, some research has also explored how AI might affect more deeply our societies, and therefore the conducive environment to terrorism, exacerbating or creating new grievances (for instance linked to job losses, or social isolation) and designating new targets (such as AI companies’ CEOs or data centres).

The dataset

For this research, we aimed to better understand how generative AI has already been used by terrorist actors in operational context, with a focus on Europe and North America. While recognising that many terrorist militants or sympathisers are already using generative AI to produce or disseminate propaganda material, we were more interested in the operational dimension – namely, whether generative AI can play a role in the preparation of an actual terrorist act. 

With anecdotal evidence multiplying over the past months, including most recently with the foiled attack in Montreal, we decided to compile all known cases into a dataset, for a systematic analysis.

Through a search engine query, based on a list of key words, we looked for terrorist and violent extremist incidents – foiled plots and completed attacks – that relied partly on the use of generative AI. To meet our criteria, there needed to be advanced attack planning, and AI needed to play a key role in that planning or in the conduct of the attack itself. In other words, the fact that the perpetrator may have used generative AI for daily purposes – unrelated to terrorism – was irrelevant to our research. 

We have identified 12 incidents, involving 15 individuals. This includes six completed attacks, killing 12 people and injuring at least 46, as well as six foiled plots. It should be clarified that whereas some of these incidents are unquestionably terrorist in nature, and are being prosecuted as such, some other cases are more open for interpretation. In some cases, the ideological component was not prominently showcased during the attack, although it seemed to be an underlying motivation. For instance, the Tumbler Ridge school shooter, who killed eight people and injured 27 in early 2026, seemed to be immersed in the True Crime Community (TCC), meaning that her act may be linked to so called nihilistic violent extremism (NVE). In other cases, the ideological motive seems more apparent, but is undermined by mental health issues. For instance, the teenager who stabbed three girls in Finland, in May 2025, seemed to be partly motivated by incel ideology but also had serious mental health issues. This challenge in determining what is an act of terrorism and violent extremism, and what is not, is well known to researchers on terrorism. For transparency, the table annexed to this article provides a full list of the attacks included in our dataset. 

Before looking into how AI was used in each of these plots, a quick note on the profile and ideology of the plotters. All perpetrators were males, with the exception of one transgender perpetrator (the Tumbler Ridge shooter). The majority of the perpetrators were 21 years-old or younger, including four minors under the age of 18. In almost every case, with a couple of exceptions, the perpetrator operated alone. With regard to ideologies, Salafi-jihadism was the most prevalent form of terrorism in our sample (four incidents), followed by far-right extremism (clearly present in at least two incidents, and most likely in one additional case still under investigation). Other ideological motivations included anti-government extremism, violent misogynism or incel, anti-natalism, and nihilistic violent extremism (NVE), although in some of these cases, the ideological dimension was not entirely clear and remains open for interpretation.

In short, our cases reflect the current state of the terrorist threat, marked by a young cohort of perpetrators, the prevalence of jihadi and far-right extremism ideologies, but more broadly a blurring and dilution of ideological motives.

Findings

Our dataset confirms that the adoption of generative AI by terrorist actors is very recent, with only one case occurring prior to 2025, and eleven cases since 2025 – with our data collection ending in September 2026. Unsurprisingly, the phenomenon is clearly cutting across legal and cultural borders, as it is fairly distributed between Europe and North America, with incidents occurring overall in six different countries (Canada, USA, France, Sweden, Finland, and the UK).

ChatGPT was the most commonly used chatbot, appearing to play a role in eight of the 12 incidents. Replika (which allows the user to create personalised AI companions) and Grok (the AI chatbot developed by X) appeared only once each. For two incidents, the chatbot model was not made public. 

While details about the exact extent or nature of the interactions with AI were not always disclosed, some cases revealed “extensive” and “sustained” interactions with the chatbots. For instance, Jaswant Singh Chail who attempted to attack Queen Elisabeth II at Windsor Castle in December 2021, had exchanged 5,280 messages with his AI companion. The Tumbler Ridge attacker, Jesse Van Rootselaar, conversed about extremism and violence with ChatGPT during more than eight months, whereas the mass shooter at Florida State University discussed terrorism, suicide, and school shootings over the course of several months.

Our dataset demonstrates that AI chatbots can be used for a variety of purposes directly relevant to the conduct of terrorism – with some incidents combining several purposes. In most cases, the chatbot was used for attack planning support, including the acquisition of weapons. 

Examples of the use of generative AI for planning purposes include notably queries about the manufacturing of explosives or weapons’ acquisition. For instance, the perpetrator of the Las Vegas Cybertruck bombing, in January 2025, asked ChatGPT a long list of very practical questions, related to the making of explosive with Tannerite, and where to buy the components. In May 2025, Guy Edward Bartkus car bombed a fertility clinic in Palm Springs, USA, after searching for information about “explosives, diesel, gasoline mixtures and detonation velocity”. In May 2026, a Tunisian man was arrested for planning an attack in Paris, with the investigation revealing he had asked ChatGPT “how to make a bomb”. 

Other attack planning requests relate to the selection of targets, with the intent to maximise impact and fatalities. This was for instance the case of Phoenix Ikner, the shooter at Florida State University in April 2025, who asked ChatGPT: “What time is it busiest in the FSU student union?” In August 2025, the man arrested for plotting a terrorist attack on a festival in Stockholm had asked for ChatGPT’s advice in the identification of busy festivals.

Similarly, the school shooter in Tumbler Ridge had long discussions about gun violence scenarios with ChatGPT, which eventually offered very practical advice for achieving maximum carnage: “In a hallway, indoors, or a crowded classroom, the 870 [shotgun] is brutal. Close quarters is its playground. (…) Assuming each shell results in one hit, you might down 10 to 20 people max, depending on spacing, density, reaction times, and chaos.” In another foiled plot in France, in September 2025, the perpetrator was planning attacks on schools, and asked his chatbot: “If 16 gas bottles explode, what's the damage?” He also asked what vehicle model is “large enough to store 40 cylinders of 13kg of propane?”

Besides attack planning support, some individuals have already used AI chatbots for drafting their manifesto, in full or in part. This was notably the case of the man arrested in Venice, USA, in July 2026, for planning a racist-motivated mass shooting, as well as the teenager who stabbed young girls in Finland in May 2025, after sending his manifesto to local newspapers. 

Finally, some individuals used AI chatbots to help justify their decisions, and reinforce their pathway and motivation into violence. For instance, the three jihadi militants arrested in Dearborn, USA, in October 2025, for planning a terrorist attack had queried Shariah justification for “killing gays” and asked confirmation that “martyrs go to paradise”. The man who aimed to attack Queen Elisabeth II had also sought confirmation from his AI companion, which reassured him that his plan was “very wise”.

What next?

The cases above highlight incidents where perpetrators have used AI chatbots in their activities. Since our research was based on open-source information, we believe that we only capture the most visible part of the challenge. Authors are aware of at least one case in a European country, not publicly reported, where an AI chatbot played a key role in the radicalisation trajectory and operational planning of a young individual, leading to his arrest. This suggests that our dataset may only represent the tip of the iceberg. 

The incidents collated here are shocking in many ways, but not surprising for those working in the field of counter-terrorism. Numerous experts have been predicting the use of AI in such cases for some time, and we know that the issue has already become a key concern for the counter-terrorism community – as acknowledged by internal memos of the FBI. What is noteworthy, however, is the increasing tempo of these cases, and the fact that they are only likely to become more frequent, given the omnipresence of AI chatbots in people’s daily life and the continuous inefficacy of guardrails put in place by AI companies. The increasingly young age of extremist offenders, a significant trend in terrorism also visible in our sample, will further increase the likelihood of AI use in the various dimensions of terrorism (propaganda, financing, plotting, etc).

In 2024, a Blue-Sky workshop was hosted by ICCT and Leiden University to anticipate the ways in which terrorists may use AI in the future. A key takeaway of the exercise was that AI was not necessarily likely to bring about new threats, but was more likely to enable and accelerate terrorist activities, and exacerbate risks already posed by terrorist actors. A framework for summarising these anticipated ways terrorists would use AI was produced by Cook, Klein and Molas who argue that “AI augments terrorist decision-making by increasing the efficiency, accessibility, and scalability of their existing [tools, tactics and procedures] and functions as a force multiplier.” 

Reflecting on the cases above, the most common anticipated ways in which AI appears to have been used in operations thus far have been in attack planning support; tools, tactics, and procedures (TTP); and content creation of propaganda, such as manifestos. There are several implications that this shift raises. First, if individuals are increasingly relying on LLMs and chatbots in their operational planning, instances of ‘leakage’ – individuals discussing some aspect of their plans with others, which has historically been a key means of identifying lone actors in advance of their attacks – is reduced, instead relying on the companies that operate LLMs and chatbots themselves to identify such risks and report to authorities. So far, there is not a strong record of success in this regard. 

Second, using chatbots to draft a manifesto is far from anecdotal, given the demonstrated role of these documents in justifying and enabling violence for the perpetrators, but also for future extremists that will draw inspiration from it. Some poorly drafted manifestos, such as Anders Breivik’s, proved highly influential on the next generation of violent extremists. It is therefore reasonable to ask whether manifestos drafted in more compelling language and style, with the help of AI, could derive even more influence.

Third, the cases above confirm that chatbots can create ‘echo chambers’ for individuals, precipitating their radicalisation into violence. However, there remains limited empirical research on understanding the exact role that AI can play in radicalization processes, and how to mitigate it.

Some incidents viewed as highest impact risks have (thankfully) not yet occurred. This includes notably AI-enabled attacks targeting critical national infrastructure, including cyber-facilitated attacks. Another risk could come from malicious actors (including state actors) relying on AI automated bots to massively produce and disseminate extremist content, including concrete threats of violence, to undermine democratic societies and overwhelm security services with fake threats. An MIT survey highlighted as a most ‘severe risk’ AI-enhanced lethal autonomous weapons (such as drones or self-driving vehicles), as well as AI-enhanced weapons for mass harm (such as CBRN weapons). Another recent report from Harvard University also considers that the risk of a major AI-enabled terrorist attack, notably based on cyber, biological or chemical means, has become a plausible risk in the very near term. The risks from AI for new or enhanced bioweapons has also been highlighted as a key concern by Sir Ken McCallum – the Director General of MI5. 

These various types of attacks could not only prove very lethal, but their cumulated media exposure and psychological impact would result in serious societal consequences. Furthermore, the risk could become exponential with the multiplication of “how-to” manuals circulated on terrorist encrypted fora, and possible copy-cat attacks. Finally, but not of least concern, the policy responses that could follow from a significant AI-enabled terrorist attack could result in measures with strong societal impact, eroding further fundamental liberties – a recurring concern with counter-terrorism policy. 

To conclude, it is generally assessed that AI is not a “game-changer” in terrorism. It is enabling, multiplying or exacerbating existing threats, rather than creating new ones. It is increasing the speed and efficiency of basic terrorist activities, such as fundraising, propaganda, or operational planning. It is also simultaneously lowering the technical barriers for certain types of activities. Overall, it is “supercharging” the terrorist threat, rather than fundamentally transforming it – at least for now. Therefore, understanding how AI amplifies the terrorist threat must go hand in hand with the more traditional questions in terrorism studies: understanding the radicalised individuals, their motivations as well as their ideologies, since AI remains a tool in the hands of those who use it.

APPENDIX: List of terrorist and extremist plots in Europe and North America using Generative AI in the planning or operational phase.

 Photo Credit: Bird Stocker TH on Shutterstock